1bd3337a6c10520e8102e166f70981851b2e6144a3c600c23711c7de84af2b18

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 12:59

Target

31AA8EC187E1241A94127336996F9CB38719EB9B.exe
Size

404KB
MD5

226b276b333804a0a5aac78d8e11ddf0
SHA1

31aa8ec187e1241a94127336996f9cb38719eb9b
SHA256

ca805825dcaf51d1c45c71258f8ab2a67c4c880a1f252e1cd470832f7f867b54
SHA512

a9a8dc4aeea8983d62a36e892fb0d96a902e4a53742f5c0d7de9711a7bc356b84c507b8322f1bbbeb5879103ca9824653a32e0d4441227df67b179c911348e3d
SSDEEP

6144:a3sHlvDPwV6H72Hup4KZLkbQsx8wXxV1FAyaCi89T/WB8U/hcxHFCu0:/dzwVxHf4sQsx5v1FTbTOuE8HsB

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\31AA8EC187E1241A94127336996F9CB38719EB9B.exe	31AA8EC187E1241A94127336996F9CB38719EB9B.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\31AA8EC187E1241A94127336996F9CB38719EB9B.exe	31AA8EC187E1241A94127336996F9CB38719EB9B.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28
PID 2176 wrote to memory of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28
PID 2176 wrote to memory of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28
PID 2176 wrote to memory of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28
PID 2176 wrote to memory of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28
PID 2176 wrote to memory of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28
PID 2176 wrote to memory of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28
PID 2176 wrote to memory of 3008	2176	31AA8EC187E1241A94127336996F9CB38719EB9B.exe	28

C:\Users\Admin\AppData\Local\Temp\31AA8EC187E1241A94127336996F9CB38719EB9B.exe
"C:\Users\Admin\AppData\Local\Temp\31AA8EC187E1241A94127336996F9CB38719EB9B.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\31AA8EC187E1241A94127336996F9CB38719EB9B.exe
  "C:\Users\Admin\AppData\Local\Temp\31AA8EC187E1241A94127336996F9CB38719EB9B.exe"
  2⤵
  - Drops startup file
  PID:3008

memory/3008-2-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3008-4-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3008-6-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3008-8-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/3008-9-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3008-5-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3008-10-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3008-12-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3008-13-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3008-14-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/3008-15-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3008-17-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download